Hot Topic shoppers’ credit card, personal info exposed in data breach

Hot Topic shoppers may have had some of their personal information accessed by hackers after the clothing company announced a breach.

The company identified “suspicious login activity to certain Hot Topic Rewards accounts,” according to an email sent out to customers. Hot Topic’s investigation into the hack found that “unauthorized parties launched automated attacks” against the company’s site and mobile application in 2023 on Nov. 18-19 and Nov. 25, the email said.

The hackers obtained valid account credentials, including email addresses and passwords, from an “unknown third party source” to log into shoppers’ accounts, Hot Topic’s email said.

“Hot Topic was not the source of the account credentials used in these attacks,” according to the California-headquartered company’s email.

What information did hackers access from Hot Topic shoppers?

Shoppers whose accounts were logged into by hackers during the breach may have had their name, email address, order history, phone number, month and day of their birth and mailing address accessed, Hot Topic said.

If a customer had their payment card saved to their Hot Topic Rewards account, the hacker could only view the last four digits of the card number on file, according to the company.

Hot Topic has not been able to determine which accounts were accessed by hackers as opposed to actual customers who logged in during the breach, the company’s email said.

What is Hot Topic doing to prevent further breaches?

Hot Topic said it is “working with outside cybersecurity experts” and has already implemented steps to safeguard the company’s site and mobile application from “automated credential stuff attacks,” including bot protection software.

“Hot Topic takes this event very seriously,” the company’s email said. “After detecting suspicious activity, we promptly began an investigation and took action to address the activity.”